Five Years of 'Make 0Day Hard'
summary
Project Zero describes five years of active vulnerability research, exploit writing and advocacy that measurably shifts attacker economics: 1500+ vulnerabilities reported, heavy use of manual review and fuzzing, and bespoke exploit development for Broadcom Wi‑Fi, Flash and iOS/Android chains. The team drives concrete defenses—Chrome sandbox changes, click‑to‑play for Flash, improved vendor firmware processes and wider IOMMU adoption—often taking longer than 90 days to coordinate fixes and publishing full technical details to force structural improvements rather than just patching single bugs.
AI-written summary · about
chapters (21)
- 0:00Start
- 11:36by methodology?
- 17:08Structural Change
- 19:54Spectre and Meltdown -- by Jann Horn et al.
- 21:59Flash -- team effort
- 24:16Interlude: a note on structural improvements
- 25:10Broadcom WiFi -- Exploit Development
- 26:02Broadcom WiFi -- Structural Improvements
- 27:25Project Zero summary of results
- 27:50How do we measure the "hard" in "make Oday hard"?
- 29:06Assessing "progress towards hard" instead
- 37:48Data is the Beginning, Not the End
- 38:28Immortal Disclosure Debates
- 39:16The Comfortable Model
- 40:16Vulnerability Triage Blues
- 42:02Vulnerabilities Matter
- 42:56A Small Aside on Bug Collision
- 43:52Opportunism is Magic
- 44:28Greatness
- 46:25Plan A
- 47:08Some Old Ideas and Some New Ideas
related talks
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
35m0-day In-the-Wild Exploitation in 2022...so far.
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves
24mHacking The 0day Market
15mThink Zero Days Are Your Your Biggest Risk - Think Again
36mFrom Bounties to Bureaucracy
44m10 years of Working with the Community
53mVulnerabilities Are Ingredients And OWASP Top 10 The Seasoning- Meghan Jacquot